diff options
| author | Masato Noguchi <Masato.Noguchi@jp.sony.com> | 2007-02-13 21:54:30 +0100 |
|---|---|---|
| committer | Arnd Bergmann <arnd@klappe.arndb.de> | 2007-02-13 21:55:43 +0100 |
| commit | 128b8546a83a9e37448bc126e1045dc1db291165 (patch) | |
| tree | 01281bb501601f643f50210314bcc31f44f5dcf7 | |
| parent | 2eb1b12049844a8ebc670e0e4fc908bc3f8933d3 (diff) | |
| download | op-kernel-dev-128b8546a83a9e37448bc126e1045dc1db291165.zip op-kernel-dev-128b8546a83a9e37448bc126e1045dc1db291165.tar.gz | |
[POWERPC] spufs: avoid accessing kernel memory through mmapped /mem node
I found an exploit in current kernel.
Currently, there is no range check about mmapping "/mem" node in
spufs. Thus, an application can access privilege memory region.
In case this kernel already worked on a public server, I send this
information only here.
If there are such servers in somewhere, please replace it, ASAP.
Signed-off-by: Masato Noguchi <Masato.Noguchi@jp.sony.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
| -rw-r--r-- | arch/powerpc/platforms/cell/spufs/file.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c index c729813..b00653d 100644 --- a/arch/powerpc/platforms/cell/spufs/file.c +++ b/arch/powerpc/platforms/cell/spufs/file.c @@ -103,6 +103,9 @@ static unsigned long spufs_mem_mmap_nopfn(struct vm_area_struct *vma, offset += vma->vm_pgoff << PAGE_SHIFT; + if (offset >= LS_SIZE) + return NOPFN_SIGBUS; + spu_acquire(ctx); if (ctx->state == SPU_STATE_SAVED) { |
